Principle of ARP deception

What is the ARP cheating?From IP addresses to physical address mapping there are two ways: table form and way of the form.ARP (Address Resolution Protocol) is the Address Resolution Protocol, the principle of ARP cheating, is a kind of IP addresses into physical addresses.ARP specifically to the network layer (IP layer, which is equivalent to the third layer of the OSI) address resolution for the data link layer, MAC layer, which is equivalent to the OSI layer 2) of the MAC address.

Under normal circumstances, when to send data B, will go to check out the local ARP cache table first, find the IP address of the corresponding MAC address B, will be for data transmission.Broadcasts an ARP request A message (carries the IP address of the host A Ia Pa) - physical address, request the IP address for the Ib Pb host B answer physical address.All hosts include B received ARP request online, but only the IP address of the host B don't own knowledge, and to A host sends an ARP reply message.The MAC address, which contains A B receives the B after the reply, will update the local ARP cache.Then use the MAC address to send data (by nic additional MAC address).Therefore, the local cache of the ARP table is the basis of the circulation of the local network, and the cache is dynamic.

ARP protocol is not only to send ARP request to receive ARP reply.When computer receives an ARP reply packet, will be for local ARP cache is updated, the response of the IP and MAC address is stored in the ARP cache.Therefore, when A machine B to A in local area network (LAN) to send A fake ARP reply, and if the response is B as C forged, the IP address is C IP, and the MAC address is fake, when after A received B faked ARP reply, will update the local ARP cache, so it seems to A C IP address does not change, but its MAC address is not the same.As a result of the LAN network flow is not according to the IP address, but shall be carried out in accordance with the MAC address.So, the fake MAC address be changed into one does not exist in A MAC address, the sample can cause network impassability, leading to A can't Ping C!This is a simple ARP deception.